AZL-99279 CVE-2026-84304 affecting package moby-containerd-cc 1.7.7-16

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

AZL-98385 CVE-2026-37236 affecting package moby-containerd-cc 1.7.7-16

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

CVE-2026-56852 affecting package moby-containerd-cc for versions less than 1.7.7-16

CVE-2026-56852 affecting package moby-containerd-cc for versions less than 1.7.7-16. A patched version of the package is available...

AZL-93261 CVE-2026-56852 affecting package moby-containerd-cc for versions less than 1.7.7-16

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-53488 affecting package moby-containerd-cc for versions less than 1.7.7-15

CVE-2026-53488 affecting package moby-containerd-cc for versions less than 1.7.7-15. A patched version of the package is available...

CVE-2026-46680 affecting package moby-containerd-cc for versions less than 1.7.7-15

CVE-2026-46680 affecting package moby-containerd-cc for versions less than 1.7.7-15. A patched version of the package is available...

CVE-2026-39821 affecting package moby-containerd-cc for versions less than 1.7.7-13

CVE-2026-39821 affecting package moby-containerd-cc for versions less than 1.7.7-13. A patched version of the package is available...

AZL-88059 CVE-2026-39821 affecting package moby-containerd-cc for versions less than 1.7.7-13

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

CVE-2026-35469 affecting package moby-containerd-cc for versions less than 1.7.7-12

CVE-2026-35469 affecting package moby-containerd-cc for versions less than 1.7.7-12. A patched version of the package is available...

CVE-2026-39882 affecting package moby-containerd-cc for versions less than 1.7.7-11

CVE-2026-39882 affecting package moby-containerd-cc for versions less than 1.7.7-11. A patched version of the package is available...

CVE-2025-64329 affecting package moby-containerd-cc for versions less than 1.7.7-10

CVE-2025-64329 affecting package moby-containerd-cc for versions less than 1.7.7-10. A patched version of the package is available...

CVE-2024-25621 affecting package moby-containerd-cc for versions less than 1.7.7-10

CVE-2024-25621 affecting package moby-containerd-cc for versions less than 1.7.7-10. A patched version of the package is available...

CVE-2025-64329 affecting package moby-containerd-cc for versions less than 1.7.7-13

CVE-2025-64329 affecting package moby-containerd-cc for versions less than 1.7.7-13. A patched version of the package is available...

CVE-2024-25621 affecting package moby-containerd for versions less than 1.6.26-13

CVE-2024-25621 affecting package moby-containerd for versions less than 1.6.26-13. A patched version of the package is available...

CVE-2024-25621 affecting package moby-containerd-cc for versions less than 1.7.7-13

CVE-2024-25621 affecting package moby-containerd-cc for versions less than 1.7.7-13. A patched version of the package is available...

CVE-2025-64329 affecting package moby-containerd for versions less than 1.6.26-13

CVE-2025-64329 affecting package moby-containerd for versions less than 1.6.26-13. A patched version of the package is available...

AZL-69973 CVE-2025-64329 affecting package moby-containerd for versions less than 1.6.26-13

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is...

AZL-69745 CVE-2025-64329 affecting package moby-containerd-cc for versions less than 1.7.7-10

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is...

CVE-2025-27144 affecting package moby-containerd-cc for versions less than 1.7.7-9

CVE-2025-27144 affecting package moby-containerd-cc for versions less than 1.7.7-9. A patched version of the package is available...

CVE-2024-40635 affecting package moby-containerd-cc for versions less than 1.7.7-9

CVE-2024-40635 affecting package moby-containerd-cc for versions less than 1.7.7-9. A patched version of the package is available...